I looked into this some time ago and found that wireguard cannot run on fargate due to requiring kernel modifications and the userspace implementation[0] has similar blockers.

[0]: https://github.com/aws/containers-roadmap/issues/239